fsylvain
cbb403011a
fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)
2026-09-25 05:33:02 +02:00
fsylvain
f3ec3d2fa2
fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused
2026-09-25 05:03:34 +02:00
fsylvain
81c4b62175
fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404
2026-09-24 16:32:40 +02:00
fsylvain
2ee28203ab
fix: API responses never include a user's password, verification code or reset code hashes, or their expiry dates; verifying an account returns only the public user fields
2026-09-24 15:39:50 +02:00
fsylvain
aa865af2e9
refac: reamaining auth surface rewrite, T0
2026-09-24 05:11:49 +02:00
fsylvain
6d510d2805
refac: register only open while no verified acc exists, enforced by a use case rather than handler & sends verification email whose link uses the conf pub URL whose code expires after 2h
2026-09-24 03:36:37 +02:00
fsylvain
6e9e108033
refac: several unverified users can exist at once: an empty reset or verification code is stored as no value so it doesn't break the unique constraint, and deleting a user removes the row so the same username and email can register again
2026-09-24 01:59:24 +02:00
fsylvain
0b4e614ec9
refac: runtime settings are read once at startup and passed in through the composition root; no handler, router or repository reads environment variables
2026-09-24 01:30:00 +02:00
fsylvain
e474f03d91
refac: authenticated user can upload an image to an existing article and receives its public location; an unknown article returns 404 and a disallowed type returns 400
2026-09-24 00:33:26 +02:00
fsylvain
5992c8598b
refac: allowed image types and the size limit are a domain rule checked by the use case, not by the persistence layer
2026-09-24 00:03:29 +02:00
fsylvain
8a8a24434a
refac: deleting an article also deletes its images, and deleting a missing article returns 404
2026-09-23 23:42:18 +02:00
fsylvain
c16fdbd26d
refac: authenticated user can edit an article's body; an unknown id returns 404
2026-09-23 23:24:03 +02:00
fsylvain
8822bdddd0
refac: authenticated user can publish and unpublish an article; an unknown id returns 404
2026-09-23 22:54:44 +02:00
fsylvain
790d4e6da6
refac: authenticated user can list all articles, including offline ones, while the public list only shows online ones
2026-09-23 22:36:41 +02:00
fsylvain
6a2ca07b66
refac: repository updates, image attachment and deletes report the domain not-found error for an unknown id, the same for articles, users and images, and the test fakes stop returning GORM errors
2026-09-23 22:09:06 +02:00
fsylvain
4278d96882
refac: article title rules are the same in the API request and the domain; an invalid title returns 400 instead of 500
2026-09-23 20:04:09 +02:00
fsylvain
ff8cd5f0ec
refac: password and code hashing & checking go through a domain hasher interface used by the use cases instead of bcrypt in the user repository and the auth handler
2026-09-23 19:29:20 +02:00
fsylvain
8460a078e3
refac: missing user or article is reported with a domain not-found error instead of a raw GORM error, and the API answers 404 for it
2026-09-23 18:55:05 +02:00
fsylvain
7c57173497
feat: characterized the existing use cases as a baseline; every repo fake behaves like the real ones and can be told to fail, every use case is covered; gremlins runs clean on useCases
2026-09-23 18:21:46 +02:00
Floriansylvain
9c80cb9885
feat: unit testing mocked repos / domain
2025-12-22 02:49:57 +01:00
Florian Sylvain
b470bfcc67
refac: renamed 'post' -> 'article'
2025-11-17 19:27:48 +01:00
Florian Sylvain
a77a5ad314
refac: fixed, better, smarter, correct dependency injection
2025-03-29 00:51:01 +01:00
Florian Sylvain
4d6054e22b
refac: separated api content into sub-packages & renamed usecases
2025-03-13 19:43:12 +01:00
Florian Sylvain
7d2795a9e0
feat: post deletion
2024-05-19 17:12:48 +02:00
Florian Sylvain
29fce9a241
brand: GohCMS -> GoCMS, project-wide
2024-05-15 19:34:38 +02:00
Florian Sylvain
00a4e464ff
clean: refactor auth & login page auth
2024-05-13 11:11:58 +02:00
Florian Sylvain
e113c79a6d
fix: all remaining "article" replaced by "post"
...
All instances of the term "article" were replaced with "post" in variable names, type names, function names, etc. This was primarily to ensure consistent naming and reduce confusion going forward. The term "post" was chosen as it's a more commonly used term for the involved operations in the context of content management and blogging platforms. All tests were also updated to reflect these changes.
2023-09-06 03:38:52 +02:00
Florian Sylvain
554fdc1989
clean: Article to Post in domain and related use cases
...
Renamed the 'Article' domain to 'Post' in order to better reflect the purpose and utility of the object. The change involved renaming all related use cases, classes, and other references from 'Article' to 'Post' and updating all functions and data types to work with Posts instead of Articles.
2023-09-06 01:56:27 +02:00
Florian Sylvain
60e25cea2f
fix: set "DB_FILE" environment variable in tests
...
This commit adds a line to set the "DB_FILE" environment variable in tests. This ensures that tests are always using "test.db" for database related operations, aligning testing environment accurately which guarantees consistent results.
2023-08-13 21:41:04 +02:00
Florian Sylvain
64ecbc6995
clean: removed ignored err var declaration
2023-08-13 03:21:47 +02:00
Florian Sylvain
e575062209
clean: removed too deeply nested tests
2023-08-12 20:52:32 +02:00
Florian Sylvain
542bcded3e
fix: panic on test.db rm err
2023-08-12 02:39:42 +02:00
Florian Sylvain
46daadb8e4
feat: tests (article)
2023-08-12 02:33:40 +02:00
fsylvain
Floriansylvain